{"id":"CVE-2026-117561","kind":"vulnerability","aliases":["CVE-2026-117561"],"related":[],"title":"sf-mcp: crafted Salesforce CLI flag values run shell commands as MCP user","description":"Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.","summary":"sf-mcp is a Salesforce MCP server whose escapeValue() function fails to neutralize backticks, $() substitution and other shell metacharacters in CLI flag values. Those values reach execSync, so an attacker can run arbitrary shell commands as the user running the MCP server.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","mcp","node.js","salesforce","sf-mcp"],"not_affected_if":["sf-mcp-not-installed"],"how_to_check":"- Check the installed version of sf-mcp (for example `npm ls sf-mcp` in the project or global install); versions through `1.3.2` are listed as affected.\n- Look for sf-mcp in MCP client configs (for example Claude Code or Cursor MCP settings) to find where it runs.","fix":"- Upgrade sf-mcp to a version later than `1.3.2`; the fixed version is unknown from the sources.\n- Until patched, remove or disable the sf-mcp server in MCP client configs, or run it only with tool inputs you control.","status":"open","published_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:49+00:00","updated_at":"2026-10-27T14:32:49+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T14:32:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade sf-mcp to a version later than `1.3.2`; the fixed version is unknown from the sources.\n- Until patched, remove or disable the sf-mcp server in MCP client configs, or run it only with tool inputs you control.","reach":"unknown","title":"sf-mcp: crafted Salesforce CLI flag values run shell commands as MCP user","impact":"high","summary":"sf-mcp is a Salesforce MCP server whose escapeValue() function fails to neutralize backticks, $() substitution and other shell metacharacters in CLI flag values. Those values reach execSync, so an attacker can run arbitrary shell commands as the user running the MCP server.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","salesforce","sf-mcp","node.js","ai-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary shell commands as the MCP server user.","analyst_note":"Check the NVD entry and the sf-mcp repository for the fixed version, and confirm whether exploitation needs attacker-controlled tool input.","how_to_check":"- Check the installed version of sf-mcp (for example `npm ls sf-mcp` in the project or global install); versions through `1.3.2` are listed as affected.\n- Look for sf-mcp in MCP client configs (for example Claude Code or Cursor MCP settings) to find where it runs.","needs_analyst":true,"not_affected_if":["sf-mcp-not-installed"],"who_is_affected":"Teams that run the sf-mcp server (Codefriar sf-mcp, through 1.3.2) with an MCP client, where the server accepts Salesforce CLI flag values that can be influenced by an attacker, such as prompts or content processed by an AI agent. Teams that do not run sf-mcp can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":3357,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117561':17A,20A '-2026':16A,19A '1.3.2':81C 'agent':23B 'ai':22B,25B 'ai-ag':21B 'ai-tool':24B 'allow':89C 'arbitrari':66B 'attack':63B,90C 'backtick':47B,110C 'cli':6A,54B,99C 'codefriar':76C 'command':11A,68B,85C,94C 'contain':82C 'craft':4A,97C 'cve':15A,18A 'escapevalu':42B,104C 'execsync':60B,119C 'execut':92C 'executesfcommand':121C 'fail':44B,107C 'flag':7A,55B,101C 'function':43B 'inject':86C 'mcp':3A,13A,27B,32B,35B,39B,74B,79C,126C 'metacharact':52B,115C 'neutral':46B,109C 'node.js':28B 'os':84C 'reach':59B,118C 'run':9A,65B,72B,123C 'salesforc':5A,29B,38B,98C 'server':40B,75B,127C 'sf':2A,31B,34B,78C 'sf-mcp':1A,30B,33B,77C 'shell':10A,51B,67B,93C,114C 'src/utils.ts':106C 'substitut':48B,111C 'suppli':96C 'tool':26B,100C 'user':14A,71B,128C 'valu':8A,56B,58B,102C,117C 'vulner':87C 'whose':41B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the sf-mcp server (Codefriar sf-mcp, through 1.3.2) with an MCP client, where the server accepts Salesforce CLI flag values that can be influenced by an attacker, such as prompts or content processed by an AI agent. Teams that do not run sf-mcp can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117561","severity":null,"published_at":"2026-10-27T14:16:38+00:00","modified_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}